What this site collects, and what it does not

Never collected, regardless of what you choose

• Your IP address is never stored. It is used in memory to rate-limit the contact form and then discarded.
• No advertising script is loaded unless you accept the advertising category. Declining means it is never requested at all — not loaded in a limited mode.
• No cross-site tracking, no fingerprinting, no data broker, nothing sold. Ever.
• No precise location. Country is the most granular geography recorded, and only with attribution consent.
• No profile that outlives your visit. The session id lives in your tab and dies when you close it.

The three categories

• Essentialalways on

  Required for the site to work at all: the security token that protects the contact form from cross-site abuse, and your choice on this banner. No tracking, and it cannot be switched off without breaking the form.

• Understanding what's usefulopt-in only

  Which pages get read, which get abandoned, and where people give up in the contact form. Stored against a random session id that is discarded when you close the tab. No cross-site tracking, no advertising networks, no profile that outlives your visit.

• How you found meopt-in only

  Which link, search or channel brought you here, and your country — never a precise location. It tells me which of my work is actually reaching people. Nothing is sold, and nothing is shared with an ad network.

• Advertising and audience measurementopt-in only

  This is the only category that sends anything to a company other than this site. It allows Google Ad Manager, AdSense and Comscore, which fund the free learning material. Decline and the ad scripts are never loaded at all — not loaded-but-limited, never requested. Every article stays fully readable either way.

When you send a project brief

The contact form collects your name, email, optional company, project type, budget band, timeline and message. That information is used to reply to your enquiry and for nothing else — no list, no newsletter, no third-party sharing. It is validated on the server, the endpoint is CSRF-protected and rate-limited, and it reaches me either by email or through a private webhook.

Ask me to delete it and I will, on request, without asking why.

The AI assistant

When the assistant cannot answer a question, the question text is logged so I can see which content is missing. Email addresses and phone numbers are stripped from that text before it is written, and nothing about who asked is recorded. It is a list of questions, not a list of people.

Sharing with Dharmarthlabs

Dharmarthlabs is the company I founded, and aggregate analytics from this site are forwarded to its dashboard over a signed, authenticated connection. Only the categories you consented to are forwarded, and the same server-side rules apply — if you declined attribution, referrer and country are stripped before anything leaves this site.

Your rights

Under GDPR and India’s DPDP Act you can ask what is held about you, ask for it to be corrected or deleted, withdraw consent at any time, and object to processing. Email hello@codehippies.com and you will get a reply, not a form. Withdrawing consent takes one click, on the right of this page.

This page describes what the software actually does. It is not legal advice, and a business with specific regulatory obligations should have a lawyer review its own policy text.